A Chinese automaker testing its driver-assistance stack in Germany wants to send training clips home. A supplier needs to ship a control program's source code to a parent company abroad. Each transfer is now a question with no clean answer.
A June 2025 draft from eight regulators tries to give that answer — but it is still a draft, and the gate is not yet installed.
Key takeaways
- Eight ministries and agencies — led by the Ministry of Industry and Information Technology (MIIT) and the Cyberspace Administration of China (CAC, 国家网信办) — published the Automotive Data Export Security Guide (2025 Edition) as a draft for comment (征求意见稿) on 13 June 2025.
- The comment window closed on 13 July 2025. As reviewed here, the text is a draft for comment and has not been finalized into a binding normative document (规范性文件); it should not be treated as in force.
- It sets three export paths: a security assessment for the riskiest flows, a standard contract or certification for mid-size personal-information flows, and nine exemption scenarios.
- Thresholds that trigger a mandatory assessment: exporting important data, or cumulatively 1,000,000 or more individuals' personal information (non-sensitive) from 1 January in a year, or 10,000 or more individuals' sensitive personal information.
- It names the automotive-data handlers broadly — manufacturers, parts and software suppliers, telecom operators, autonomous-driving service providers, platforms, dealers, repairers, and mobility operators — and details important data by business scenario.
Why a sector-specific rule
China already has a general data-export framework under the Cybersecurity Law, the Data Security Law, the Personal Information Protection Law, and the Network Data Security Management Regulation. A 2021 trial automotive-data measure introduced principles like "process inside the vehicle." Yet companies kept hitting the same wall: the general rules were clear in spirit but thin on what an automaker actually moves.
The 2025 draft narrows that gap for a sector where cross-border flows are routine — global R&D, overseas production, and autonomous-driving validation all pull data across borders. The drafting bodies, working under the national data-security coordination mechanism, say the aim is an "efficient, convenient, and secure" export mechanism rather than a blanket block.
The three export behaviors
The draft first defines what counts as an export at all, and it is wider than "send a file abroad":
- Data collected and generated in domestic operations is transmitted to a location outside China.
- Data stored inside China is queried, retrieved, downloaded, or exported by an overseas party.
- Personal-information processing about domestic individuals happens outside China under the Personal Information Protection Law's extraterritorial reach.
That second behavior is the quiet trap: data that never leaves a Chinese server can still be an "export" the moment a foreign colleague pulls it.
The three paths
Path one — security assessment (申报数据出境安全评估). Mandatory when any of these hold: the data is "important data"; or from 1 January in a year the handler has cumulatively provided 1,000,000 or more individuals' personal information excluding sensitive data; or 10,000 or more individuals' sensitive personal information; or the handler is a critical information infrastructure operator providing personal information.
Path two — standard contract or certification. For handlers that are not critical-infrastructure operators: cumulatively 100,000 or more but under 1,000,000 individuals' non-sensitive personal information, or under 10,000 individuals' sensitive personal information, can use either a personal-information export standard contract or certification.
Path three — nine exemptions. These skip the assessment, contract, and certification entirely: data collected abroad and returned after processing with no domestic personal information or important data introduced; cross-border car purchases, parcel delivery, or payments; cross-border human-resources management under lawful rules; emergency protection of life, health, or property; small flows under 100,000 individuals' non-sensitive, non-important personal information; free-trade-zone negative-list carve-outs; security-vulnerability data already reported to MIIT; security-incident data already reported to regulators; and OTA upgrade source code already filed with the market regulator for a recall.
Important data, by scenario
The draft's most detailed contribution is a scenario-by-scenario catalog of "important data" that would force an assessment. Five core scenarios anchor it:
- Research and development: bills of materials, design documents, product and development source code.
- Manufacturing: process bills of materials and production-control program source code.
- Driving automation: algorithms, training data, and feature data for assisted or autonomous driving.
- Software upgrade services: source code for power, chassis, and safety-driving software packages.
- Networked operation: vehicle identifiers, in-vehicle keys and digital certificates, control commands, roadside perception data, and autonomous-driving map data.
An industry body, CATARC (中汽中心), later tallied the important-data provisions as 27 categories across the scenarios. The draft pairs each item with a judgment rule, nudging identification toward measurable tests.
The stage, stated plainly
This is the part most often misreported. The text published on 13 June 2025 is a draft for comment (征求意见稿). It says it "intends to be issued as a normative document." The comment deadline was 13 July 2025. In the sources reviewed for this article, it had not been finalized into a binding rule. Anyone describing it as "China's new automotive data-export law now in force" would be wrong. The correct framing is: proposed and consulted, not yet effective — a design to prepare for, not a constraint currently in force.
Honest limitations
This article is based on the June 2025 draft-for-comment text and contemporaneous official and industry reporting; because the document is a draft, its thresholds, scenarios, and exemptions may change before any final issuance, and the status described here reflects sources available at writing. The 27-category tally is a third-party (CATARC) analysis, not the draft's own wording, and should be reconfirmed against the finalized text. This piece covers the automotive-specific draft only and does not restate the broader data-export framework in full. Readers must verify the current stage on MIIT and CAC channels, since a finalized version may have appeared after the sources used here. No financial figures are involved.
What readers can do now
- Run a data-inventory sweep against the five scenarios. Even though the draft is not in force, its scenario catalog is a ready-made checklist for tagging important data in R&D, manufacturing, driving automation, upgrades, and networked operation.
- Separate your three paths now. Map each cross-border flow to assessment, contract/certification, or exemption so you know which transfers would survive a finalized rule.
- Watch MIIT and CAC for the finalized text. The draft's comment window has closed; track the issuing agencies for the binding version and any shifted thresholds before planning overseas data architecture.